A VPN — virtual private network — is a service that encrypts your internet traffic and routes it through a server run by the VPN provider. When people ask what is a VPN in practical terms: it’s a secure tunnel between your device and the internet. Your internet provider sees only encrypted traffic to the VPN server, and websites see the VPN server’s IP address instead of yours.
VPNs have gone mainstream: remote workers use them for office access, travelers use them on hotel Wi-Fi, and privacy-conscious users run them full-time. But marketing often overpromises — VPNs are powerful tools with specific strengths and real limitations. Understanding what a VPN actually does (and doesn’t do) helps you decide when one is worth using.
This guide explains how VPNs work technically, what they protect against, what they can’t protect against, the different protocols and features, and the honest use cases where a VPN genuinely helps. No hype — just how the technology works and where it fits.
- How a VPN Works: The Encrypted Tunnel
- What a VPN Hides — and From Whom
- What a VPN Cannot Do
- VPN Protocols Compared Briefly
- Key Features to Look For
- When a VPN Genuinely Helps
How a VPN Works: The Encrypted Tunnel
Normally, your device connects directly to websites through your internet provider, which can see which sites you visit. With a VPN, your device first establishes an encrypted connection to a VPN server; all your traffic flows through this tunnel to the server, which then forwards it to its destination. To outside observers, your activity appears as indecipherable encrypted data flowing to one address.
The encryption is the critical part: it prevents your internet provider, network operator, or anyone snooping on local Wi-Fi from reading your traffic or seeing which sites you visit. The VPN server then makes requests on your behalf, so websites see the server’s IP address and location rather than yours — which is also how VPNs can make it appear you’re browsing from another city or country.
Trust shifts rather than disappears: instead of trusting your internet provider with your browsing data, you trust the VPN provider. This is why provider choice matters enormously — a VPN merely moves the privacy question from one company to another. Choose providers with audited no-logs policies and transparent ownership, and be wary of free VPNs with unclear business models.
What a VPN Hides — and From Whom
From your internet provider and local network: a VPN hides which websites you visit and the contents of unencrypted traffic. Your ISP sees only encrypted packets flowing to the VPN server. On public Wi-Fi, this defeats the classic snooping attacks — which is why our public Wi-Fi safety tips recommend VPNs as the single most effective protection on untrusted networks.
From websites and trackers: a VPN hides your real IP address and approximate location, which complicates IP-based tracking and geolocation. Note the limits, though — trackers have many other identifiers (cookies, browser fingerprinting, logged-in accounts), so a VPN alone doesn’t make you anonymous to a site where you’re signed in.
From whom it doesn’t hide you: the VPN provider itself can see your traffic’s destinations (choose one you trust); law enforcement with proper legal process can compel providers in their jurisdiction; and anyone you’ve logged in with still knows exactly who you are. A VPN is a privacy tool, not an invisibility cloak.
What a VPN Cannot Do
A VPN doesn’t protect against malware — downloading an infected file over a VPN still infects your device. It doesn’t stop phishing — a fake login page works identically through the tunnel. It doesn’t make you anonymous — your accounts, cookies, and browser fingerprint still identify you. And it doesn’t secure the destination: if a website is breached, your data there is exposed regardless of how you connected.
VPNs also don’t encrypt everything in the way people assume: DNS requests (which translate domain names to addresses) can leak outside the tunnel with poor implementations, revealing your browsing destinations. Quality VPN apps prevent DNS leaks, but it’s worth verifying with a leak test after setup.
Performance is another honest limitation: encryption and rerouting add latency and can reduce speeds, though modern protocols have narrowed the gap considerably. If raw speed matters for your task, our guide on testing your internet speed properly helps you measure the actual impact rather than guessing.
VPN Protocols Compared Briefly
VPN protocols are the underlying technologies establishing the encrypted tunnel, and they differ in speed, security, and compatibility. OpenVPN is the long-standing open-source standard: thoroughly audited, highly configurable, widely supported — and somewhat slower than newer options. It’s the safe default when available.
WireGuard is the modern challenger: dramatically simpler code (easier to audit), faster connections, and excellent mobile performance as you move between networks. Most reputable providers now offer it, and it’s become the recommended choice for most users. IKEv2/IPSec remains common on mobile for its ability to reestablish connections quickly when switching networks.
Older protocols like PPTP and L2TP have known weaknesses and should be avoided. Some providers offer proprietary protocols built on WireGuard or OpenVPN foundations — evaluate these on independent audit evidence rather than marketing claims. The practical advice: use WireGuard or OpenVPN from a reputable provider and you’ll be on solid ground.
Key Features to Look For
A kill switch is the most important safety feature: it blocks all internet traffic if the VPN connection drops, preventing accidental exposure. Without one, a momentary dropout silently returns you to an unprotected connection. Enable it and leave it on — it’s the feature that makes VPN protection reliable rather than theoretical.
Next: a genuinely audited no-logs policy (independently verified, not just claimed), DNS leak protection, support for modern protocols, and apps for all your devices. Multi-hop (routing through two servers) and split tunneling (choosing which apps use the VPN) are useful extras for specific needs. For home-wide coverage, some people install VPNs at the router level — see our router buying guide for hardware that supports this.
Evaluate the company behind the product: transparent ownership, jurisdiction (which affects legal data requests), track record, and a sustainable paid business model. Free VPNs often monetize through ads, data sales, or bandwidth limits that push upgrades — the economics deserve scrutiny when the product is your privacy.
When a VPN Genuinely Helps
Public Wi-Fi protection is the clearest win: on untrusted networks, a VPN neutralizes snooping and fake-hotspot attacks in one stroke. Remote work is another: many employers require VPNs to access office resources securely, and freelancers handling client data benefit similarly. Travelers use VPNs to access home services abroad and to protect connections on hotel networks.
Journalists, activists, and researchers in restrictive environments rely on VPNs (often alongside Tor) to work safely — though threat models here demand careful, expert setup beyond a consumer app. For everyday users, the honest assessment is narrower: a VPN meaningfully improves privacy against ISP tracking and network snooping, with modest benefits elsewhere.
What a VPN isn’t: a complete privacy solution, a security suite, or a way to evade the law. Used with clear-eyed expectations — as one layer among good passwords, updated software, and careful browsing — it’s a genuinely useful tool. The EFF’s privacy resources at https://www.eff.org/ offer deeper guidance on fitting VPNs into a broader privacy strategy.